End-to-End Detection & Incident Response Engineer

Runway; United States; Hybrid; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Unlimited PTO

401k matching

Remote stipend

Parental leave

L&D stipend

Wellness stipend

Job summary

Runway is seeking a Detection & Response Engineer to own how we find and stop attacks across our infrastructure, research environment, and products. You’ll write detections as code, automate response, and shape the program end-to-end with ownership from logging to incident closure.

You’ll partner with platform and research teams, build telemetry, and drive gated security reviews. Strong cloud/Kubernetes experience and incident response mindset are required.

Qualifications

• Experience building and tuning detections in a modern SIEM, ideally managed as code.
• Hands-on incident response experience: triage live alerts, investigations, and post-incident reports.
• Familiarity with cloud platforms (AWS/GCP/Azure) and Kubernetes at an audit/logging level.
• Experience monitoring GPU/HPC-like infrastructure or research environments with large datasets.
• Ability to write Python/Typescript/Rust to automate response workflows and integrate security tools.
• Experience with AI/ML tooling or guards for AI agents in production environments.

Responsibilities

• Own detection program end to end: logging, alerting, triage, and recovery.
• Write and tune detections as code across cloud environments, Kubernetes, identity systems, endpoints, and SaaS.
• Lead incident response from first alert through containment and forensics; produce post-incident reviews.

Skills

Detections as code

Incident response

Cloud security

Kubernetes

Python scripting

Threat hunting

Tools

AWS

GCP

Azure

SIEM

Job description

Runway is seeking a Detection & Response Engineer to own how we find and stop attacks across our infrastructure, research environment, and products. You’ll write detections as code, automate response, and shape the program end-to-end with ownership from logging to incident closure.

You’ll partner with platform and research teams, build telemetry, and drive gated security reviews. Strong cloud/Kubernetes experience and incident response mindset are required.